December 9, 2020

Spotify USA Inc.

150 Greenwich Street
New York, NY 10007

Hi,

We recently emailed you about an issue that caused us to reset your Spotify password.

Protecting privacy and maintaining user trust are top priorities at Spotify, and we want to share
additional details about what happened.  
 
NOTICE OF DATA BREACH

We deeply regret to inform you that your Spotify account registration information was
inadvertently exposed to certain of Spotify’s business partners. Firstly, we want to apologize
that there has been an incident. Although the incident has been contained and remediated, we
understand the concern that may come with such incidents. Because of this, we want to provide
you with further information about what happened and inform you of some precautionary steps
that you can take to ensure that your information remains protected.

WHAT HAPPENED?
On Thursday November 12th, Spotify discovered a vulnerability in our system that inadvertently
exposed your Spotify account registration information, which may have included email address,
your preferred display name, password, gender, and date of birth only to certain business
partners of Spotify. Spotify did not make this information publicly accessible. We estimate that
this vulnerability existed as of April 9, 2020 until we discovered it on November 12, 2020, when
we took immediate steps to correct it.

WHAT INFORMATION WAS INVOLVED?

The personal information that may have been exposed included your Spotify account registration
information, including email and password, gender, date of birth, and email address.

WHAT WE ARE DOING.

We take any loss of personal information very seriously and are taking steps to help protect you
and your personal information. We have conducted an internal investigation and have contacted
all of our business partners that may have had access to your account information to ensure that
any personal information that may have been inadvertently disclosed to them has been deleted.
We also reset your Spotify password to help keep your account secure.
WHAT YOU CAN DO.
We have no reason to believe that any unauthorized use of your information has or will occur,
however, we urge you to change the passwords of all other online accounts for which you use the
same email address and password. We apologize for any inconvenience this may cause.

OTHER IMPORTANT INFORMATION.

Again, while we are not aware of any unauthorized use of your personal information, as a
precautionary measure, we encourage you to remain vigilant by monitoring your account closely.
If you detect any suspicious activity on your Spotify account, you should promptly notify us.

FOR MORE INFORMATION.

If you have any more questions or need any other assistance, you can contact the Spotify team at
privacy@spotify.com.

Please be assured that we take the protection of your information very seriously. We apologize
again for any inconvenience this incident may cause you.

Sincerely,

The Spotify Team